Keystone to Destroy Nearly 19,000 Crypto Wallets After Hackers Steal Authenticity Key

Hardware wallet maker Keystone has said an attacker who broke into its website obtained the key its devices use to prove they are genuine. The company says the attacker exploited a vulnerability in a third-party data monitoring tool used by the site to gain higher privileges, which exposed customer data and the key. Keystone found the access on October 20, blocked it, and has fixed the flaw. It has not said when the attacker first got in or where the key was stored.

The risk is counterfeiting. Someone holding the key could build fake devices that pass Keystone's online verification check, and a buyer who trusted one could have their crypto stolen. Keystone says owners' recovery phrases and wallet private keys were not involved, and the key plays no part in creating them or signing transactions. The company has not reported any counterfeit devices or thefts. Because the key is written permanently into each device during manufacturing, existing units cannot be switched to a new one. Keystone will destroy 18,835 unsold devices carrying the old key, and all new devices will get a new key.

Advice depends on when a device arrived. Devices delivered before October 20 that pass the check can be considered genuine and used normally. For devices received after that date with the old key, Keystone says it cannot completely rule out that one is counterfeit even if it passes. Those owners should contact Keystone support and use the device only once the company confirms it is genuine.